|
Packit Service |
3880ab |
.TH "Flow filter in tc" 8 "20 Oct 2015" "iproute2" "Linux"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.SH NAME
|
|
Packit Service |
3880ab |
flow \- flow based traffic control filter
|
|
Packit Service |
3880ab |
.SH SYNOPSIS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Mapping mode:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.in +8
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.BR tc " " filter " ... " "flow map key "
|
|
Packit Service |
3880ab |
.IR KEY " [ " OPS " ] [ " OPTIONS " ] "
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Hashing mode:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.in +8
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.BR tc " " filter " ... " "flow hash keys "
|
|
Packit Service |
3880ab |
.IR KEY_LIST " [ "
|
|
Packit Service |
3880ab |
.B perturb
|
|
Packit Service |
3880ab |
.IR secs " ] [ " OPTIONS " ] "
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.in +8
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR OPS " := [ " OPS " ] " OP
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR OPTIONS " := [ "
|
|
Packit Service |
3880ab |
.B divisor
|
|
Packit Service |
3880ab |
.IR NUM " ] [ "
|
|
Packit Service |
3880ab |
.B baseclass
|
|
Packit Service |
3880ab |
.IR ID " ] [ "
|
|
Packit Service |
3880ab |
.B match
|
|
Packit Service |
3880ab |
.IR EMATCH_TREE " ] [ "
|
|
Packit Service |
3880ab |
.B action
|
|
Packit Service |
3880ab |
.IR ACTION_SPEC " ]"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR KEY_LIST " := [ " KEY_LIST " ] " KEY
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR OP " := { "
|
|
Packit Service |
3880ab |
.BR or " | " and " | " xor " | " rshift " | " addend " } "
|
|
Packit Service |
3880ab |
.I NUM
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR ID " := " X : Y
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR KEY " := { "
|
|
Packit Service |
3880ab |
.BR src " | " dst " | " proto " | " proto-src " | " proto-dst " | " iif " | "
|
|
Packit Service |
3880ab |
.BR priority " | " mark " | " nfct " | " nfct-src " | " nfct-dst " | "
|
|
Packit Service |
3880ab |
.BR nfct-proto-src " | " nfct-proto-dst " | " rt-classid " | " sk-uid " | "
|
|
Packit Service |
3880ab |
.BR sk-gid " | " vlan-tag " | " rxhash " }"
|
|
Packit Service |
3880ab |
.SH DESCRIPTION
|
|
Packit Service |
3880ab |
The
|
|
Packit Service |
3880ab |
.B flow
|
|
Packit Service |
3880ab |
classifier is meant to extend the
|
|
Packit Service |
3880ab |
.B SFQ
|
|
Packit Service |
3880ab |
hashing capabilities without hard-coding new hash functions. It also allows
|
|
Packit Service |
3880ab |
deterministic mappings of keys to classes.
|
|
Packit Service |
3880ab |
.SH OPTIONS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI action " ACTION_SPEC"
|
|
Packit Service |
3880ab |
Apply an action from the generic actions framework on matching packets.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI baseclass " ID"
|
|
Packit Service |
3880ab |
An offset for the resulting class ID.
|
|
Packit Service |
3880ab |
.I ID
|
|
Packit Service |
3880ab |
may be
|
|
Packit Service |
3880ab |
.BR root ", " none
|
|
Packit Service |
3880ab |
or a hexadecimal class ID in the form [\fIX\fB:\fR]\fIY\fR. \fIX\fR must
|
|
Packit Service |
3880ab |
match qdisc's/class's major handle (if omitted, the correct value is chosen
|
|
Packit Service |
3880ab |
automatically). If the whole \fBbaseclass\fR is omitted, \fIY\fR defaults
|
|
Packit Service |
3880ab |
to 1.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI divisor " NUM"
|
|
Packit Service |
3880ab |
Number of buckets to use for sorting into. Keys are calculated modulo
|
|
Packit Service |
3880ab |
.IR NUM .
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI "hash keys " KEY-LIST
|
|
Packit Service |
3880ab |
Perform a
|
|
Packit Service |
3880ab |
.B jhash2
|
|
Packit Service |
3880ab |
operation over the keys in
|
|
Packit Service |
3880ab |
.IR KEY-LIST ,
|
|
Packit Service |
3880ab |
the result (modulo the
|
|
Packit Service |
3880ab |
.B divisor
|
|
Packit Service |
3880ab |
if given) is taken as class ID, optionally offset by the value of
|
|
Packit Service |
3880ab |
.BR baseclass .
|
|
Packit Service |
3880ab |
It is possible to specify an interval (in seconds) after which
|
|
Packit Service |
3880ab |
.BR jhash2 's
|
|
Packit Service |
3880ab |
entropy source is recreated using the
|
|
Packit Service |
3880ab |
.B perturb
|
|
Packit Service |
3880ab |
parameter.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI "map key " KEY
|
|
Packit Service |
3880ab |
Packet data identified by
|
|
Packit Service |
3880ab |
.I KEY
|
|
Packit Service |
3880ab |
is translated into class IDs to push the packet into. The value may be mangled by
|
|
Packit Service |
3880ab |
.I OPS
|
|
Packit Service |
3880ab |
before using it for the mapping. They are applied in the order listed here:
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.TP 4
|
|
Packit Service |
3880ab |
.BI and " NUM"
|
|
Packit Service |
3880ab |
Perform bitwise
|
|
Packit Service |
3880ab |
.B AND
|
|
Packit Service |
3880ab |
operation with numeric value
|
|
Packit Service |
3880ab |
.IR NUM .
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI or " NUM"
|
|
Packit Service |
3880ab |
Perform bitwise
|
|
Packit Service |
3880ab |
.B OR
|
|
Packit Service |
3880ab |
operation with numeric value
|
|
Packit Service |
3880ab |
.IR NUM .
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI xor " NUM"
|
|
Packit Service |
3880ab |
Perform bitwise
|
|
Packit Service |
3880ab |
.B XOR
|
|
Packit Service |
3880ab |
operation with numeric value
|
|
Packit Service |
3880ab |
.IR NUM .
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI rshift " NUM"
|
|
Packit Service |
3880ab |
Shift the value of
|
|
Packit Service |
3880ab |
.I KEY
|
|
Packit Service |
3880ab |
to the right by
|
|
Packit Service |
3880ab |
.I NUM
|
|
Packit Service |
3880ab |
bits.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI addend " NUM"
|
|
Packit Service |
3880ab |
Add
|
|
Packit Service |
3880ab |
.I NUM
|
|
Packit Service |
3880ab |
to the value of
|
|
Packit Service |
3880ab |
.IR KEY .
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
For the
|
|
Packit Service |
3880ab |
.BR or ", " and ", " xor " and " rshift
|
|
Packit Service |
3880ab |
operations,
|
|
Packit Service |
3880ab |
.I NUM
|
|
Packit Service |
3880ab |
is assumed to be an unsigned, 32bit integer value. For the
|
|
Packit Service |
3880ab |
.B addend
|
|
Packit Service |
3880ab |
operation,
|
|
Packit Service |
3880ab |
.I NUM
|
|
Packit Service |
3880ab |
may be much more complex: It may be prefixed by a minus ('-') sign to cause
|
|
Packit Service |
3880ab |
subtraction instead of addition and for keys of
|
|
Packit Service |
3880ab |
.BR src ", " dst ", " nfct-src " and " nfct-dst
|
|
Packit Service |
3880ab |
it may be given in IP address notation. See below for an illustrating example.
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI match " EMATCH_TREE"
|
|
Packit Service |
3880ab |
Match packets using the extended match infrastructure. See
|
|
Packit Service |
3880ab |
.BR tc-ematch (8)
|
|
Packit Service |
3880ab |
for a detailed description of the allowed syntax in
|
|
Packit Service |
3880ab |
.IR EMATCH_TREE .
|
|
Packit Service |
3880ab |
.SH KEYS
|
|
Packit Service |
3880ab |
In mapping mode, a single key is used (after optional permutation) to build a
|
|
Packit Service |
3880ab |
class ID. The resulting ID is deducible in most cases. In hashing more, a number
|
|
Packit Service |
3880ab |
of keys may be specified which are then hashed and the output used as class ID.
|
|
Packit Service |
3880ab |
This ID is not deducible in beforehand, and may even change over time for a
|
|
Packit Service |
3880ab |
given flow if a
|
|
Packit Service |
3880ab |
.B perturb
|
|
Packit Service |
3880ab |
interval has been given.
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
The range of class IDs can be limited by the
|
|
Packit Service |
3880ab |
.B divisor
|
|
Packit Service |
3880ab |
option, which is used for a modulus.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BR src ", " dst
|
|
Packit Service |
3880ab |
Use source or destination address as key. In case of IPv4 and TIPC, this is the
|
|
Packit Service |
3880ab |
actual address value. For IPv6, the 128bit address is folded into a 32bit value
|
|
Packit Service |
3880ab |
by XOR'ing the four 32bit words. In all other cases, the kernel-internal socket
|
|
Packit Service |
3880ab |
address is used (after folding into 32bits on 64bit systems).
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B proto
|
|
Packit Service |
3880ab |
Use the layer four protocol number as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B proto-src
|
|
Packit Service |
3880ab |
Use the layer four source port as key. If not available, the kernel-internal
|
|
Packit Service |
3880ab |
socket address is used instead.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B proto-dst
|
|
Packit Service |
3880ab |
Use the layer four destination port as key. If not available, the associated
|
|
Packit Service |
3880ab |
kernel-internal dst_entry address is used after XOR'ing with the packet's
|
|
Packit Service |
3880ab |
layer three protocol number.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B iif
|
|
Packit Service |
3880ab |
Use the incoming interface index as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B priority
|
|
Packit Service |
3880ab |
Use the packet's priority as key. Usually this is the IP header's DSCP/ECN
|
|
Packit Service |
3880ab |
value.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B mark
|
|
Packit Service |
3880ab |
Use the netfilter
|
|
Packit Service |
3880ab |
.B fwmark
|
|
Packit Service |
3880ab |
as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B nfct
|
|
Packit Service |
3880ab |
Use the associated conntrack entry address as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BR nfct-src ", " nfct-dst ", " nfct-proto-src ", " nfct-proto-dst
|
|
Packit Service |
3880ab |
These are conntrack-aware variants of
|
|
Packit Service |
3880ab |
.BR src ", " dst ", " proto-src " and " proto-dst .
|
|
Packit Service |
3880ab |
In case of NAT, these are basically the packet header's values before NAT was
|
|
Packit Service |
3880ab |
applied.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B rt-classid
|
|
Packit Service |
3880ab |
Use the packet's destination routing table entry's realm as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B sk-uid
|
|
Packit Service |
3880ab |
.TQ
|
|
Packit Service |
3880ab |
.B sk-gid
|
|
Packit Service |
3880ab |
For locally generated packets, use the user or group ID the originating socket
|
|
Packit Service |
3880ab |
belongs to as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B vlan-tag
|
|
Packit Service |
3880ab |
Use the packet's vlan ID as key.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.B rxhash
|
|
Packit Service |
3880ab |
Use the flow hash as key.
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.SH EXAMPLES
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Classic SFQ hash:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.EX
|
|
Packit Service |
3880ab |
tc filter add ... flow hash \\
|
|
Packit Service |
3880ab |
keys src,dst,proto,proto-src,proto-dst divisor 1024
|
|
Packit Service |
3880ab |
.EE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Classic SFQ hash, but using information from conntrack to work properly in combination with NAT:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.EX
|
|
Packit Service |
3880ab |
tc filter add ... flow hash \\
|
|
Packit Service |
3880ab |
keys nfct-src,nfct-dst,proto,nfct-proto-src,nfct-proto-dst \\
|
|
Packit Service |
3880ab |
divisor 1024
|
|
Packit Service |
3880ab |
.EE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Map destination IPs of 192.168.0.0/24 to classids 1-256:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.EX
|
|
Packit Service |
3880ab |
tc filter add ... flow map \\
|
|
Packit Service |
3880ab |
key dst addend -192.168.0.0 divisor 256
|
|
Packit Service |
3880ab |
.EE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
Alternative to the above:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.EX
|
|
Packit Service |
3880ab |
tc filter add ... flow map \\
|
|
Packit Service |
3880ab |
key dst and 0xff
|
|
Packit Service |
3880ab |
.EE
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
The same, but in reverse order:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.EX
|
|
Packit Service |
3880ab |
tc filter add ... flow map \\
|
|
Packit Service |
3880ab |
key dst and 0xff xor 0xff
|
|
Packit Service |
3880ab |
.EE
|
|
Packit Service |
3880ab |
.SH SEE ALSO
|
|
Packit Service |
3880ab |
.BR tc (8),
|
|
Packit Service |
3880ab |
.BR tc-ematch (8),
|
|
Packit Service |
3880ab |
.BR tc-sfq (8)
|